> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hightouch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Web Services

> Grant Hightouch access to resources within your AWS account.

## Overview

Hightouch's AWS integration powers several features:

* Workspace deployment on AWS (see [Regions](https://docs.hightouch.com/security/regions.md#supported-regions))
* [Self-hosted storage via S3](https://docs.hightouch.com/security/storage.md#self-hosted-storage)
* [Athena](https://docs.hightouch.com/sources/amazon-athena.md) source
* [S3](https://docs.hightouch.com/sources/s3.md) source
* [S3](https://docs.hightouch.com/destinations/s3.md) destination
* [AWS PrivateLink](https://docs.hightouch.com/security/aws/privatelink.md)

## Setup

To give Hightouch access to resources on your AWS account,
go to the [**Cloud providers**](https://app.hightouch.com/settings/cloud-providers?from=docs) tab on the Settings page.
Click **Add cloud provider**, and select **Amazon Web Services**.

![Adding a new cloud provider in Hightouch](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/cloud-providers/add-new-credential.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=0c60f0fd564c5dc0747f01e0deaa5077)

Give your credential a **Display name**, then select either **Cross-account role** or **Access key**.

### Cross-account role

Cross-account roles are a mechanism provided by AWS to allow you to grant secure access to Hightouch without requiring that you hand over sensitive secrets like Secret Access Keys.

The Hightouch UI displays an **AWS account ID** and a randomly generated **AWS external ID**, as shown below, which you need to enter into an IAM Role you create in your AWS account. Store these values for future reference.

![AWS credential generation in the Hightouch UI](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/aws/cross-account-1-generate-credentials.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=6bdb480a9aac7257930710a2bb786c1e)

> [!TIP]
>
> Neither the Account ID nor the external ID are secrets, so you don't need to worry about securely storing them.

1. From your AWS console, navigate to **Identity and Access Management (IAM)** > **Access Management** > **Roles** and click **Create Role**.

   ![Role creation in the AWS console](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/aws/cross-account-1-create-role.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=8d1ebbc7ce1689c7eefdc0348e1aa6be)
2. Under **Select type of trusted entity**, choose **AWS account**. Then under **An AWS account**, select **Another AWS account**.

   ![Role creation in the AWS console](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/aws/cross-account-2-create-role.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=d31bf488869050166b3c0f78e6ee35eb)
3. Enter the **Account ID** you copied from the Hightouch UI, select **Require external ID** and enter the external ID you copied from the Hightouch UI. Click **Next**.
4. Attach permissions to the role, choose a role name, then click **Create role**. The exact permission policies you attach depend on which Hightouch features you intend to use. Consult the documentation [for those services](#overview) for further guidance.

   ![Role creation in the AWS console](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/aws/cross-account-3-create-role.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=0f21227e1b2ea4d6c6b51c6c7e4f78b4)
5. Copy the **Role ARN** from AWS IAM and paste it into the **Role ARN** field in Hightouch. Click **Create** to complete the process.

   ![Role creation in the AWS console](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/aws/cross-account-4-create-role.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=ac7c9ff1f49f7084e5fdcf72ac4379a1)

For more information, read [AWS's tutorial](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html) on delegating access cross-account using IAM Roles.

### Access key

The **Access Key** access type allows you to configure Hightouch to use an IAM user by providing the user's **Access Key ID** and **Secret Access Key**.

If you need help generating these keys, consult the [IAM article](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) on this topic.

Once you have an Access Key ID and Secret Access Key, paste those values into the form and click **Create**.

![Role creation in the AWS console](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/aws/access-key.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=473e4fe406a203f07515058e0138c086)

## Tips and troubleshooting

### CredentialsError: Missing credentials in configuration

If you receive the following error `CredentialsError: Missing credentials in config`, it means Hightouch can't assume the role required by your Athena or S3 sync, or [external storage](https://docs.hightouch.com/security/storage.md) configuration.

This error is often due to an issue with the [IAM trust policy](https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/). This policy defines which other AWS accounts can assume roles in your account. When you set up AWS credentials in Hightouch using a [cross-account role](#cross-account-role), we provide you with Hightouch's Account ID and an additional external ID. You should include Hightouch's Account ID in your role trust policy, and can optionally include the external ID.

To troubleshoot this error, follow these steps:

* Ensure that the role exists.
* Ensure that the role has a trust policy attached.
* Ensure that the role's trust policy includes our Hightouch AWS account ID (`324528010823`) as a principal.
* If the role trust policy includes an external ID check, ensure it matches the external ID generated by Hightouch. See the example below:

![Trust policy in the AWS console](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/aws/trusted-entity.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=e23c3503ce2d6076b545028f00945480)

If you want to check the external ID but misplaced the external ID that Hightouch generates, you need to [re-create the cloud provider integration in Hightouch](#setup). Hightouch only displays this value once during cloud provider setup.